Farol's interactive report flags the most dangerous files and provides a 0–100 risk score for the pull request.
FAROL TOOL MAPS RISK OF GITHUB PULL REQUESTS FOR APPROVERS
*Farol adds deterministic risk scores to PRs after AI review. Open‑source, runs locally or in CI, and flags the files that truly matter.*
A new open‑source tool called Farol is reshaping how developers approve code changes on GitHub. After an AI review, Farol steps in to tell the approver exactly how risky a merge is and which files carry that risk. The tool runs on the developer's machine or CI runner, never sending code to an external service. By leveraging static analysis from real compilers, Farol delivers deterministic risk scores that stay consistent across runs. In an era where a single line can break dozens of pages, Farol promises to focus human attention where it matters most.
What is Farol and how does it work?
Farol is a free, open‑source CLI and GitHub Action that runs after an AI review. It reads the diff, feeds the full program and the compilers' view (TypeScript type checker, go/types, Python ast) into a model, then produces a deterministic report. The same pull request always yields the same verdict. Farol never executes the code and never sends it anywhere. It can be invoked with npx @winninjs/farol or via the winnin/farol/action in a CI runner. The tool comments on every PR, but it does not block merges.
How does Farol assess pull‑request risk?
Farol builds a declaration graph from the real compilers, then measures reach, diff coverage, security findings, contract breaks and dependency changes. The output is a verdict—fast track, quick review, or careful review—and a 0–100 risk score. It also lists every page, API operation, RPC method, job and script that the changed code can reach, complete with call chains. Files that carry the highest risk appear first, with inline diffs, untested lines marked, and a checklist for manual testing.
Why reviewers need Farol beyond AI?
AI agents comment on individual lines, but the final approval remains a scarce human decision. A single‑line change to a shared hook can take down forty pages, illustrating how skim‑reading leads to disaster. Farol triages before the reviewer opens the diff, highlighting the real impact. In a typical 40‑file PR, only two or three files can actually hurt. By ranking those files, Farol lets reviewers skim the rest with confidence and focus on the risky changes line by line.
What does the live demo reveal?
The demo applies Farol to a pull request on the FastAPI full‑stack template, which combines a FastAPI backend with a React frontend using TanStack Router. The backend report flags a breaking contract change and a high‑severity security finding, issuing a "careful review" verdict. The frontend report marks a new page and a shared component that reaches existing pages, also prompting a careful review. Reports are interactive: reviewers can mark files as reviewed, toggle feature flags, view inline diffs, and copy the review record from the Result tab.
Frequently asked questions
What risk score range does Farol provide?
Farol returns a 0–100 risk score based on reach, diff coverage, security findings, contract breaks and dependency changes.
Does Farol execute the code or send it to external services?
No. Farol never executes your code and never sends it anywhere.
How can developers run Farol on a pull request?
Run it as a CLI with npx @winninjs/farol or add the GitHub Action winnin/farol/action to CI; no account or hosted service is required.
Farol bridges the gap between fast AI commentary and the final human gate. By surfacing reach, security findings, and contract breaks in a reproducible report, it forces reviewers to confront the true impact of each change. As open‑source projects adopt the CLI or GitHub Action, the balance of speed and safety in code review could shift dramatically, making careless merges a relic of the past.
Sources: [Show HN: Farol – a risk map of a pull request for the person who approves it]